{ "ml": { "v": "7", "eng": "2.1.0-rc.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.04282509, "rte": "az", "prob": 0.04282509 } ], "prob": 0.08827829, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.08827829360961914, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.08827829360961914, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010391076102678198, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-19T03:27:11Z" }, "path": "dbus-x11-1.16.2-r2.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!b", "ln": 0 } ], "mol": "H₂(FPo)Md₂(BiHe)", "sha": "e840cc3fa78f2c4885294b793a209db2cdc6979e4ef5e4fc1399358b9a5cfca4", "path": "dbus-x11-1.16.2-r2.apk", "risk": 5, "size": 11418, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 11418.0, "entropy": 7.97, "size_bytes": 11418.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.97 } } }, "traits": [ { "id": "micro-behaviors/process/user/query::getpwuid", "atk": "T1033", "mbc": "E1033", "crit": 3, "desc": "Get password file entry by UID", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/layout::elf-has-overlay", "conf": 0.9599999785423279, "crit": 3, "desc": "ELF binary has trailing overlay data", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/multiplex::select-multiplex", "crit": 3, "desc": "select() I/O multiplexing", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/layout::elf-overlay-over-512", "conf": 0.9599999785423279, "crit": 3, "desc": "ELF overlay exceeds 512 bytes", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::x11-ref", "crit": 2, "desc": "X11 windowing reference", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/family::system-lib-marker", "crit": 2, "desc": "Known system library markers", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::graphics-lib-marker", "conf": 0.6000000238418579, "crit": 2, "desc": "Graphics/OpenGL library markers", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91)\u003ejUv00000kMy=:00000fKT}Y0000000000kMA+z4feS[8#{]T1][S6", "ln": 0 }, { "b": "P7?7UD=FZ+fdyH]^?4R.az.Guy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000050000[000010000600000FDbVI1Ybp}0000", "ln": 857 }, { "b": "kl7V-000010000000000CvticAa@?.B97@hB-WR8x\u003eI0]AccwDwPN]?wO(p5C4yU{zG6SgzGGE\u003cxjVf@zGV1!uT[s?uUj1\u0026vqGU7wDlvOBAIqd0bVdXy\u0026r!-w[C\u003e4B7+LXuVQr$v@2BYxLQ%!vqfJTB98CAz!]z)x(ER-CxdztwDlsYA+PAkw=MgBwmY^)xk8BewPzc\u0026A:-/@uUKy\u0026zV", "ln": 2897 }, { "b": "By/F(o*--nzE(^QvR/PQA+eV\u00260crm5zEWTh0a{d\u0026yxdZkr83.gwPzu{x(!xcA-t+2y\u0026si5raflLwDlsXAaJ[!w[bT}B7Ct)BAg(dz#:%3wmY!40af8AA=M5ouU\u003cS", "ln": 3077 }, { "b": "z/bL@BAhhezuao/B-.W8wQ4=@C5NB#yH?d10af8NwOkZ#By/G1w].r%wNxd?w]vVRwmxX5uUi?Q", "ln": 3180 }, { "b": "ASyf5A=Vty0crm5v}Y(.wQ4{h0cqZ/wN//ZswSNDwnb{]09Alsxl4A\u0026q!o#)wPv=Mq!p5xpEPqAz/OxSzE^M{ASxiqAaJ]Px(!lfvr?\u0026PnP5SYA=af+z/2FRm}D^vwO+{/BzkVhpJ{X/ASu", "ln": 3484 }, { "b": "svl+gzF9JSA=k]dA==Nbsvmauvru6Zx(mE1Ck#i0wN/JRxjVg7CxERg0bDp+yYFf\u003cvruQp0a*y^v@c8:v}Yy!ASy63By/uk0cq\u003c!vpKy[z/bL@y?mf%0af8Hx\u003c$NVB97\u0026hBye([x(i]!x\u003c$QZB-Pb?e]$}-gxql9vPUute]$}-humMcvQ?3cB-RvJCSmP*hz^4cz.r:AoI4Mslrc@\u003ef\u003c=ZpoI4Mslrc@\u003ep/o\u003e=k#ZoWf!Lf", "ln": 3678 }, { "b": "eK6kCvS=-zy*?E7v}V#?eIhcSA=U@kzE1w?eIgTEy\u0026AV5tp?BFxF1pJzGGrit{9u6eN@\u003cneD", "ln": 16896 }, { "b": "luNt(oKS6Yv}YB]ash7olVl{?A+Pf1Brz#0diHx1fF:?HwN(]Ovrs4ynP52\u003c3rgXMB0bgrao", "ln": 17213 }, { "b": "B0a[eayPq6B.$YcBs)[2q+ftJoAnNzxAg+nv}YN]wGT#MnKKXsz/^avA=lbnwmYo]ve", "ln": 17606 }, { "b": "c36y[srHghaz2Olz/Mf+nkz@G07ggjcV*FzwPP5qB7GwmxM4:0ay]hbwN/?2A^m#(", "ln": 18907 }, { "b": "c36y[B7GAlx(v(vvS=.(l}HrNoHh!YstqJMx(n37xl4B5x(v(iwnc9[vR/Q^ayX[(vrDR", "ln": 19013 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "ln": 24649 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "ln": 24828 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "stderr" ], [ "stdout" ], [ "fini" ] ], "imp": [ [ "", "execvp" ], [ "", "XInternAtom" ], [ "", "dbus_ensure_standard_fds" ], [ "", "dbus_strerror" ], [ "", "write" ], [ "", "XCreateWindow" ], [ "", "pipe" ], [ "", "snprintf" ], [ "", "deregister_frame_info" ], [ "", "strcmp" ], [ "", "dbus_fd_clear_close_on_exec" ], [ "", "putenv" ], [ "", "XSetSelectionOwner" ], [ "", "malloc" ], [ "", "fork" ], [ "", "memmove" ], [ "", "strcat" ], [ "", "fflush" ], [ "", "strncmp" ], [ "", "XOpenDisplay" ], [ "", "strcpy" ], [ "", "strrchr" ], [ "", "fclose" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "sleep" ], [ "", "strstr" ], [ "", "kill" ], [ "", "dbus_error_free" ], [ "", "dbus_string_free" ], [ "", "dbus_fd_set_all_close_on_exec" ], [ "", "XGetSelectionOwner" ], [ "", "strchr" ], [ "", "XNextEvent" ], [ "", "XChangeProperty" ], [ "", "getpwuid" ], [ "", "printf" ], [ "", "XGetWindowProperty" ], [ "", "waitpid" ], [ "", "libc_start_main" ], [ "", "XGrabServer" ], [ "", "strncpy" ], [ "", "sigemptyset" ], [ "", "cxa_finalize" ], [ "", "register_frame_info" ], [ "", "XSetIOErrorHandler" ], [ "", "exit" ], [ "", "fprintf" ], [ "", "execlp" ], [ "", "dbus_string_init" ], [ "", "close" ], [ "", "ITM_registerTMCloneTable" ], [ "", "execl" ], [ "", "read" ], [ "", "XFlush" ], [ "", "XUngrabServer" ], [ "", "errno_location" ], [ "", "mkdir" ], [ "", "fputs" ], [ "", "chdir" ], [ "", "free" ], [ "", "dbus_strdup" ], [ "", "isatty" ], [ "", "dbus_try_get_local_machine_id" ], [ "", "XPending" ], [ "", "puts" ], [ "", "strerror" ], [ "", "fopen" ], [ "", "select" ], [ "", "getenv" ], [ "", "sigaction" ], [ "", "strlen" ], [ "", "strtol" ], [ "", "stack_chk_fail" ], [ "", "dbus_lookup_session_address" ], [ "", "XFree" ], [ "", "getuid" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.87, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.25, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 60, 3.07, "alloc" ], [ ".dynsym", 968, 1944, 1.05, "alloc" ], [ ".dynstr", 2912, 977, 4.81, "alloc" ], [ ".gnu.version", 3890, 162, 1.31, "alloc" ], [ ".gnu.version_r", 4056, 48, 2.53, "alloc" ], [ ".rela.dyn", 4104, 1848, 1.49, "alloc" ], [ ".rela.plt", 5952, 24, 0.98, "alloc,info_link" ], [ ".relr.dyn", 5976, 24, 0.98, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 32, 3.05, "alloc,executable" ], [ ".text", 8240, 8136, 5.89, "alloc,executable" ], [ ".fini", 16376, 3, 1.58, "alloc,executable" ], [ ".rodata", 16384, 3428, 5.24, "alloc" ], [ ".eh_frame_hdr", 19812, 196, 4.17, "alloc" ], [ ".eh_frame", 20008, 1236, 5.0, "alloc" ], [ ".init_array", 23280, 8, 0.54, "write,alloc" ], [ ".fini_array", 23288, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 23296, 40, 0.0, "write,alloc" ], [ ".dynamic", 23336, 592, 1.45, "write,alloc" ], [ ".got", 23928, 632, 0.07, "write,alloc" ], [ ".data", 24576, 12, 1.28, "write,alloc" ], [ ".comment", 24588, 28, 3.99, "merge,strings" ], [ ".shstrtab", 24616, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 12271.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 81.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 77.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 81.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 8187.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 8187.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 26672.0, "entropy": 4.43, "size_bytes": 26672.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.88, "data_entropy": 0.72, "overlay_size": 1794.0, "string_count": 195.0, "overlay_ratio": 0.07, "overall_entropy": 4.43, "overlay_entropy": 1.44, "entropy_variance": 2.94, "avg_string_length": 23.11, "max_string_length": 220.0, "code_to_data_ratio": 0.86, "string_length_stddev": 26.9, "largest_section_ratio": 0.31, "sentence_string_count": 53.0, "sentence_string_ratio": 0.27, "high_entropy_string_count": 0.0 }, "exports": { "count": 4.0 }, "imports": { "count": 76.0 }, "sections": { "count": 28.0, "code_size": 8174.0, "entropy_max": 5.89, "entropy_mean": 2.52, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 1, "mol": "H₂(FPo)Md₂(BiHe)", "path": "dbus-x11-1.16.2-r2.apk!!usr/bin/dbus-launch", "risk": 5, "sha": "2c773c2022113c41a922c8f495436d2e84e27dce911447d99247d0a704c3083a", "size": 26672, "traits": [ { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 3029, 5 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 3093, 4 ] ] }, { "id": "micro-behaviors/dylib/library/family::x11-ref", "crit": 2, "desc": "X11 windowing reference", "spans": [ [ 3804, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2966, 12 ] ] }, { "id": "metadata/binary/layout::elf-has-overlay", "conf": 0.9599999785423279, "crit": 3, "desc": "ELF binary has trailing overlay data", "spans": [ [ 0, 25 ] ] }, { "id": "metadata/binary/layout::elf-overlay-over-512", "conf": 0.9599999785423279, "crit": 3, "desc": "ELF overlay exceeds 512 bytes", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::select-multiplex", "crit": 3, "desc": "select() I/O multiplexing", "spans": [ [ 3505, 6 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 3196, 6 ], [ 3708, 5 ], [ 3735, 6 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/process/user/query::getpwuid", "atk": "T1033", "mbc": "E1033", "crit": 3, "desc": "Get password file entry by UID", "spans": [ [ 3714, 8 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 3196, 6 ], [ 3708, 5 ], [ 3735, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2966, 12 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 3029, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 3093, 4 ] ] }, { "id": "micro-behaviors/dylib/library/family::graphics-lib-marker", "conf": 0.6000000238418579, "crit": 2, "desc": "Graphics/OpenGL library markers", "spans": [ [ 3804, 6 ] ] }, { "id": "micro-behaviors/dylib/library/family::system-lib-marker", "crit": 2, "desc": "Known system library markers", "spans": [ [ 3804, 6 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 3029, 5 ], [ 3093, 4 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2966, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGThePJM", "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[oAB-PcVf!\u0026", "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[RatCG6hzc:pAXW", "ln": 4, "addr": 87 }, { "b": "Abf8%wPIu7jS)\u0026Yf^6[nwg..qB0b7kAV^+4lrc}", "ln": 5, "addr": 106 }, { "b": "B-IpvjS[AWBz#pZfe4J[Cp)GFwO2y-B8b(oA4V6Hxd)h4w]@l9A+c[mvS=.", "ln": 6, "addr": 138 }, { "b": "B7]@iauZ\u00265hA0GH", "ln": 9, "addr": 267 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 280 }, { "b": "z/PM8x(k4Ray[@7A@", "ln": 11, "addr": 294 }, { "b": "v@Dj3x(\u003eEXatvtmv\u003e}NNvRdLSfFLE%gH:/LiaDDdh-0p4wmx15h8!}#whE:Mf-", "ln": 12, "addr": 308 }, { "b": "zddc@Byw)3wPw[RaARg6z7/slAa%i3eO5BlyJKGlauT7xxLzp0kW!eox(4Prz/PFO", "ln": 13, "addr": 358 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 697.0, "entropy": 5.23, "size_bytes": 697.0 }, "binary": { "overall_entropy": 5.23 } } }, "id": 2, "path": "dbus-x11-1.16.2-r2.apk!!.PKGINFO", "risk": 1, "sha": "a42ff742a579943b5fdc2eca9b7274f04eaf6270e0c1770df17a2511dca65f16", "size": 697, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 87, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 18 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 87, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 294, 13 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 18 ], [ 87, 18 ], [ 294, 13 ] ] } ], "type": "text" } ], "v": "8" } }